Executive brief
semantic-release is an automation tool used to publish releases and manage versioning for software projects. A flaw in its credential masking allows sensitive secrets to be accidentally exposed in logs and output if those secrets contain certain characters that are not properly URI-encoded, potentially revealing authentication tokens to unauthorized viewers.
Technical details
semantic-release uses the JavaScript encodeURI function to mask secrets embedded in repository URLs. However, encodeURI deliberately excludes certain characters from encoding (per RFC 3986), allowing secrets containing those characters to pass through unmasked. The vulnerability requires an execution context where repository push access depends on credentials embedded in the repository URL, and the secrets must contain characters excluded from encodeURI encoding. An attacker with access to build logs or console output could then view exposed authentication credentials. The issue was patched in version 19.0.3 with improved encoding logic.
Affected products
- semantic-release semantic-release 17.0.4 to before 19.0.3
Timeline
- 2022-06-09: disclosed
- 2022-06-09: patched: Fixed in version 19.0.3